Biomedical Signal Processing and Control 81 (2023) 104478

Contents lists available at ScienceDirect

Biomedical Signal Processing and Control

journal homepage: www.elsevier.com/locate/bspc

Robust zero-watermarking scheme based on a depthwise overparameterized

VGG network in healthcare information security
Tongyuan Huang a , Jia Xu a ,∗, Shixin Tu b,c , Baoru Han b,c ,∗
a
School of Artificial Intelligence, Chongqing University of Technology, 401135, Chongqing, PR China
b
College of Medical Informatics, Chongqing Medical University, 400016, Chongqing, PR China
c
Gold Phoenix Industrial Research Institute of Digital Medical Things, 400039, Chongqing, PR China

ARTICLE INFO ABSTRACT

Keywords: As healthcare information technology has rapidly evolved, securely storing and transmitting medical data
Medical image online and successfully protecting patient privacy are currently the research focus in the healthcare information
Zero-watermarking field. To better protect the security of medical data, this paper introduces deep neural network and convo-
DO-VGG
lutional block attention module (CBAM) into the study of watermarking techniques and proposes a medical
CBAM
image zero-watermarking scheme based on depthwise overparameterized VGG (DO-VGG). First, we extract the
high-dimensional abstract feature information of medical images using the pretrained DO-VGG model. Then,
the construction of the zero-watermarking scheme utilizes the mean-perceptual hashing algorithm, which can
efficiently resist both common and geometric attacks. Meanwhile, using the improved logistic mapping to
encrypt the watermarking image effectively improves the security of the scheme. Experimental results indicate
that all NC values of the proposed scheme are maintained above 0.8 under various degrees of attacks, which
has good robustness and invisibility. The proposed scheme can satisfy the special requirements of medical
image integrity and effectively protect the private information of medical images.

1. Introduction pathological information. Compared with natural images, medical im-

ages are characterized by massive data volumes, distinct subregional
Benefiting from the boom in the Internet and smart medicine, mag- features, high pixel correlation, and uneven histogram distribution [5].
netic resonance imaging (MRI) and other medical technologies have The multiparametric nature of MRI images makes them richer in pro-
become essential aids in modern medical diagnoses. Medical images cessing methods. MRI images have a very high spatial resolution, which
can provide a more accurate and visual representation of patients’ causes decreased visibility of medical image details during storage
specific pathological information, and facilitate remote or real-time and compression. In addition, MRI images may be subject to Gaussian
information exchange between hospitals [1,2]. Due to the inherent noise from the object or machine being examined during imaging; or
security risks of public networks, new threats such as illegal copying, Gaussian noise added during signal conversion, resulting in poor med-
tampering, and other threats have emerged when sharing information ical image quality. To better assist doctors in diagnosis, most medical
through the Internet [3]. Therefore, it is an extremely important issue MRI images are processed with median filtering. Most importantly, in
to store massive amounts of medical data and secure shared medical re-
the medical field, the quality of a patient’s medical pathology data is
sources for interdepartmental or interregional transmission in a secure
extremely stringent, and any minor alteration may affect the doctor’s
environment. The more essential issue is how to prevent the alteration
judgement [6]. Thus, the study of lossless digital watermarking schemes
and disclosure of private patient or hospital medical data. To better
for medical images is particularly significant.
protect medical images and securely convey important information
There are two classes of lossless digital watermarking: reversible
hidden in medical images, watermarking technology is an efficient
watermarking and zero-watermarking. Reversible watermarking is
means to solve this information security problem due to its unique
robustness and security. Medical image watermarking technology plays achieved through the processes of alteration and restoration of the
a particularly important role in protecting copyright and privacy [4]. original image. If operated incorrectly, there is still a risk that the
With advances in medical imaging technology, digital medical im- original image will not be recovered, and such damage is unaccept-
ages have emerged as a vital basis for doctors to acquire patients’ able for medical images [7,8]. In contrast, zero-watermarking utilizes

∗ Corresponding author.
E-mail addresses: tyroneh@cqut.edu.cn (T. Huang), jiaxu@2020.cqut.edu.cn (J. Xu), jessie@stu.cqmu.edu.cn (S. Tu), baoruhan@cqmu.edu.cn (B. Han).

https://doi.org/10.1016/j.bspc.2022.104478
Received 30 August 2022; Received in revised form 22 November 2022; Accepted 27 November 2022
Available online 14 December 2022
1746-8094/© 2022 Elsevier Ltd. All rights reserved.
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

medical image characteristics to generate the feature sequence without neural networks is better [22,23]. Deep neural networks use multilayer
any modifications to the medical image, which ensures the integrity of convolutional filtering to analyze local features. As depth increases,
the medical image and provides good imperceptibility. Furthermore, the network can automatically learn robust and unique features from
zero-watermarking algorithms have the advantage of great robust- the original training data through nonlinear mapping, avoiding the
ness and can effectively resist a variety of attacks, which makes manual feature extraction of traditional methods. Deep neural networks
zero-watermarking well suited for medical images [9,10]. can extract more abstract features when processing images, effectively
As research deepens, an increasing number of new zero- improving the robustness of the scheme [24,25]. Therefore, based
watermarking schemes are being presented. Liu et al. [11] used the on the above works, a new robust medical image zero-watermarking
double tree complex wavelet transform (DTCWT) and the discrete scheme combining DO-VGG and an attention mechanism is proposed in
cosine transform (DCT) to obtain the feature images of medical images. this paper. The proposed scheme can efficiently protect medical images
The robustness of the scheme in resisting geometric attacks has been and solve the current problems in medical information security.
enhanced. Wu et al. [12] extracted the texture features of images In the proposed scheme, we utilize the pretrained DO-VGG model
by employing the contourlet transform and then constructed a zero- to extract the deep abstract feature information of medical images,
watermarking using the DCT. The scheme used zero-watermarking and then generate a zero-watermarking using the perceptual hashing
to protect the copyright information of medical images with good algorithm, which efficiently enhances the robustness of the scheme.
invisibility. Li et al. [13] proposed a robust watermarking scheme with Meanwhile, encryption of the watermarking image using an improved
energy relationships. This scheme constructed a zero-watermarking logistic chaotic technique increases the scheme’s security. Our results
by comparing the magnitudes of the blocked energy and the av- indicate that the proposed scheme can still accurately extract water-
erage energy of the original image. The scheme has low computa- marking images from medical images under different kinds of attacks,
tional complexity. Wu et al. [14] obtained the low-frequency sub- and displays strong robustness under different attack strengths. The
bands of each subblock by employing curvelet transform and discrete main contributions of this study are as follows:
wavelet transform (DWT) on the subblocks, and then employed zero-
watermarking using blocked singular value decomposition (SVD). This • We designed a novel deep neural network combined with an at-
scheme has good performance in resisting common robustness attacks. tention mechanism for the zero-watermarking scheme of medical
A novel multi-channel medical image zero-watermarking scheme was images. The proposed network structure has good invariance to
presented by Khalid et al. [15]. They utilized multichannel fractional- other forms of geometric attacks, such as translation and rotation.
order Gegenbauer moments (FrMGMs) to extract features from medical The network can extract deep image features with strong robust-
images. The scheme showed good robustness under all attacks. Yang ness, thus effectively enhancing the scheme’s robustness against
et al. [16] designed a zero-watermarking scheme based on Zernike- geometric attacks.
DCT. The scheme applied Zernike moments to the original medical • This paper used depthwise overparameterized convolution (DO-
image to obtain precise edge features to construct a zero-watermarking. Conv) instead of common convolution. Without increasing the
Verma et al. [17] combined the region encryption technique and computing power of the network inference, the proposed scheme
DWT to achieve watermarking embedding. The experimental results can accelerate the convergence speed and improve the expressive-
indicated that the watermarking image restored by this scheme was ness of the network.
more complete. These proposed zero-watermarking schemes exhibit • This paper introduced a CBAM into the network. The proposed
strong robustness against common attacks, but the robustness is still network extracted deep texture features from the image in both
not satisfactory under geometric attacks. channel and spatial dimensions, and the combination of the two
As seen from the above research results, the primary problem faced further enhanced the deep features. The proposed scheme can au-
by medical image watermarking schemes is the low robustness against tomatically extract rich high-dimensional complex features from
geometric attacks. Medical images have a low signal-to-noise ratio, images, thereby improving the scheme’s resistance to both com-
and the vast majority of same-site, same-body medical images have mon and geometric attacks.
both high similarities in overall structure and diversity in detail [18]. • The authors added new growth parameters to the traditional
These characteristics make the existing schemes extract mostly shallow logistic chaotic system to increase the computational complexity
medical image features. Under geometric attack, these schemes extract of the key, successfully enhancing the scheme’s security.
values with instability, resulting in the poor robustness of medical
image watermarking. Therefore, it is still difficult to extract feature 2. The fundamental theory
images from medical images that can resist geometric attacks.
With the speedy growth of artificial intelligence, it has become 2.1. Depthwise overparameterized VGG
possible to use machine learning and deep learning to improve the
robustness of medical image watermarking technology. Zhao et al. [19] The backbone network of DO-VGG is VGG16, which is one of the
used the relationship between the image mean value and the sub- representative networks for convolutional neural network models. Due
graph mean value obtained by the k-nearest neighbor mean value to the deepening of the network structure, the VGG16 model has a
algorithm to construct a zero-watermarking. The scheme has shown better learning capability when performing image feature extraction.
strong robustness. Li et al. [20] introduced a reversible medical image The VGG16 network is composed of thirteen convolutional layers, five
watermarking scheme with a residual neural network (ResNet). This pooling layers, three fully connected layers, and a softmax classifier.
scheme extracted deep features from medical images using the ResNet The VGG16 network structure is illustrated in Fig. 1. The VGG16
model and adaptively determined the optimal embedding strength network structure contains six stages: phases one and two consist of
to balance the robustness and nonvisibility. A watermarking scheme two convolutional layers and one max-pooling layer, which extract low-
for medical images with VGG19 was proposed by Han et al. [21]. level features of the image. Phases three, four, and five are all three
They utilized VGG19 to extract the image’s abstract features and then convolutional layers plus one max-pooling layer, which extracts deep-
combined the discrete Fourier transform (DFT) to construct the feature level features of the image [26]. The VGG16 network uses a global
vector. The scheme can extract the watermarking image accurately and convolutional kernel of size 3 × 3 to better extract image features in all
shows strong robustness. directions while achieving better recognition results by stacking mul-
Medical images are characterized by a large amount of data. Ma- tiple convolution layers and pooling layers to achieve deeper feature
chine learning is suitable for applications with a small number of extraction [27]. However, the VGG16 model has a large number of
features. When the number of features is large, the performance of deep parameters, which makes it time-consuming to train and predict. In

2
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 1. The network structure of VGG16.

Fig. 2. The network structure of the proposed scheme.

Fig. 3. Visualization of features: (a) shallow feature map, (b) middle feature map, and (c) deep feature map.

addition, the VGG16 model has a low correlation of shallow to deep the feature map to enhance the model’s ability to extract local texture
features, which can easily lead to the loss of detailed features. features [28].
To accelerate image classification and preserve detailed features,
based on the theory of VGG16, we propose a DO-VGG lightweight net- In this paper, unlike the image classification task, we only uti-
work model based on DO-Conv combined with an attention mechanism. lize the pretrained DO-VGG to extract the deep features of medical
The proposed network structure is displayed in Fig. 2. The DO-VGG images. Fig. 3 displays a visual analysis of the features of the DO-
network replaces the common convolution in the VGG16 network with VGG model. The figure indicates that the shallow convolutional layer
DO-Conv. DO-Conv replaces multiple consecutive linear layers with mainly extracts edge, contour, and texture information. As the network
a single linear layer, which enables the network to obtain a larger
deepens, features become complex, abstract, and incomprehensible.
perceptual field while keeping the convolution kernel unchanged, si-
High-level features gradually transform scattered detailed features into
multaneously accelerating the convergence of the network without
increasing the computational power of network inference. holistic semantic features, enabling the learning of richer information.
To prevent the loss of local information owing to multilayer DO- Therefore, the DO-VGG model can reduce redundant data through
Conv superposition, this scheme introduces a channel attention mech- autonomous learning, thus reducing the dimensionality and reinforcing
anism and a spatial attention mechanism in the last three convolution the deep semantic features. Furthermore, the DO-VGG network struc-
layers to ensure the extraction of detailed and robust features of the ture is highly invariant to translation, scaling, rotation, and other forms
image. Channel attention is used to obtain the importance of each
of distortion. The tight connections between its layers and the spatial
channel feature map, making the model focus more on channels with
high weights and suppressing channels with low weights, improving the information can automatically extract rich relevant features from the
model’s ability to extract global texture features. The spatial attention image, thus increasing the resistance of zero-watermarking to various
mechanism is used to obtain the importance of different regions in attacks.

3
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 4. The structure of DO-Conv.

2.2. Depthwise overparameterized convolution is the scaling ratio. Finally, the vector of the MLP output through the
fully connected layer generates the channel weight vector 𝑀𝑐, and then
DO-Conv refers to adding additional depth convolution operations multiplies 𝑀𝑐 with 𝐹 by the element to obtain the channel attention
to a common convolutional layer to form an overparameterized con- feature map 𝐹 ′ [31]. The formula is as follows:
volution layer. The deep convolution operation is convolved for each
𝑀𝑐 (𝐹 ) = 𝜎 (𝑀𝐿𝑃 (AvgPool (𝐹 )) + 𝑀𝐿𝑃 (MaxPool (𝐹 ))) (1)
input channel separately, and the output features are only associated
with one channel of the input features and the corresponding weights,
independent of the other channels of the input features [29]. The 𝐹 ′ = 𝑀𝑐 (𝐹 ) ⊗ 𝐹 (2)
structure of DO-Conv is shown in Fig. 4. where 𝜎(⋅) denotes the sigmoid activation function, AvgPool(⋅) and
Where 𝑊 is the underlying structure of the common convolution MaxPool(⋅) denote the average pooling and maximum pooling opera-
kernel, 𝐷 is the underlying structure of the deep convolution kernel, tions performed on the feature map, respectively.
and 𝑃 is the underlying structure of the feature map after unfolding. The spatial attention module is an extension of the channel attention
𝐶𝑖𝑛 is the input channel number, 𝐶𝑜𝑢𝑡 is the output channel number, module. The spatial attention module is relatively simple in terms of
𝑀 × 𝑁 is the block dimensions of the feature map after unfolding, and its algorithm, taking the channel attention feature matrix 𝐹 ′ as the
𝐷𝑚𝑢𝑙 is the number of deep convolution kernels. The diagram shows input matrix. 𝐹 ′ performs global max pooling and average pooling by
that the DO-Conv operation proceeds in two steps: space, and the two features generated by pooling are stitched together
(1) A deep convolution operation is performed on the input feature and convolved to generate a spatial weight vector 𝑀𝑠. Finally, 𝑀𝑠
𝑃 to obtain the intermediate variable 𝑃 ′ . That is 𝑃 ′ = 𝐷◦𝑃 . is multiplied by the element with 𝐹 ′ to obtain the spatial attentional
(2) Performing a common convolution operation on the intermedi- feature map 𝐹 ′′ [32]. The calculation process is as follows:
ate variable 𝑃 ′ yields the final result 𝑂. That is 𝑂 = 𝑊 ∗ 𝑃 ′ . ( ) ( ( ( ( ) ( ))))
𝑀𝑠 𝐹 ′ = 𝜎 𝑓 7×7 Cat AvgPool 𝐹 ′ , MaxPool 𝐹 ′ (3)
The core idea of DO-Conv is overparameterization. In the training
phase, multiple sequential linear layers are used to configure more ( )
parameters within the convolution kernel. In the validation phase, 𝐹 ′′ = 𝑀𝑠 𝐹 ′ ⊗ 𝐹 ′ (4)
multiple sequential linear layers are collapsed into a compact single where 𝑓 7×7 represents a standard convolution with a convolution kernel
layer, reducing the number of the parameters to the original number. with size 7 × 7 and Cat(⋅) represents a connection operation.
Therefore, using DO-Conv instead of common convolution accelerates The CBAM extracts deep texture features from the image in both
the convergence of the network. Meanwhile, it can use more parameters the channel and spatial dimensions by learning, and the combination of
to improve the performance of the network without increasing the the two further enhances the feature representation. Furthermore, the
computational demand, optimizing the performance of the scheme. CBAM performs convolution from multiple directions to enhance useful
features and suppress useless features in the feature map. The CBAM
2.3. Convolutional block attention module gives the scheme a fast and accurate feature extraction capability, so it
can construct a robust zero-watermarking.
The CBAM is a lightweight module that can focus on important
characteristics of an image. The CBAM combines a channel attention 2.4. Improved logistic map
mechanism with a spatial attention mechanism to allow the model to
focus on important regions in the feature map, effectively improving Chaos is seemingly irregular, referring to a random-like process that
the accuracy of the classification model [30]. Fig. 5 shows a schematic occurs in deterministic systems. Logistic chaotic systems are one of
diagram of the CBAM. the most common kinds of chaotic systems used in digital watermark-
The output matrix 𝐹 ∈ 𝑅𝐶×𝐻×𝑊 of the convolutional layer of the ing, and with initial values and parameters, chaotic systems can be
original neural network is used as the input matrix of the CBAM. First, generated [33]. Such a system is defined as follows:
the input matrix is subjected to global max pooling and global average ( )
𝑥𝑘+1 = 𝜇𝑥𝑘 1 − 𝑥𝑘 (5)
pooling by channels to extract richer higher-level features, and then
the number of channels is compressed to 𝐶∕𝑟 and expanded back to 𝐶 where 𝜇 ∈ [0, 4] is the growth parameter, 𝑥 ∈ (0, 1) is the system vari-
by a multilayer perceptron (MLP). 𝐶 is the number of channels and 𝑟 able, and 𝑘 is the iteration number. Fig. 6 illustrates the multiple period

4
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 5. Structure of the CBAM module.

Fig. 6. (a) Logistic mapping multiple period bifurcation diagram and (b) Lyapunov exponential diagram.

bifurcation plots and the Lyapunov exponent of the logistic chaotic a primary key of 𝐾1 . We encrypt the watermarking image to remove
system. A positive Lyapunov exponent implies that in the system space, the correlation between pixels and enhance the watermarking security.
the difference between the two tracks increases exponentially with the Step 2: Extraction of feature images
evolution of time, thus resulting in a chaotic phenomenon. The graph The original medical image is fed into the pretrained DO-VGG
shows that the logistic system exhibits periodicity when 0 < 𝜇 ≤ model, which extracts the deep complex feature image 𝐹 𝐴(𝑝, 𝑞, 𝑙) from
3.5699456. When 3.5699456 ≤ 𝜇 ≤ 4, the logistic mapping is in a chaotic the last convolutional layer.
state, and the Lyapunov exponent is occasionally negative.
𝐹 (𝑖, 𝑗) → 𝐷𝑂 − 𝑉 𝐺𝐺 → 𝐹 𝐴(𝑝, 𝑞, 𝑙) (7)
To enhance watermarking safety, this scheme added an additional
growth parameter 𝑣 ∈ [0, 0.25] to the logistic mapping, thus increasing where 1 ≤ 𝑝 ≤ 8, 1 ≤ 𝑞 ≤ 8, and 1 ≤ 𝑙 ≤ 512.
the computational complexity of the key [34]. The formula is given Step 3: Construction of feature vectors
below: The feature matrix 𝐹 𝐺(𝑝, 𝑞) is obtained by fusing the feature image
( ) 𝐹 𝐴(𝑝, 𝑞, 𝑙), and the fusion formula is shown in Eq. (8). Then, the feature
𝑥𝑘+1 = 𝜇(1 − 𝑣| cos(𝑘)|)𝑥𝑘 1 − 𝑥𝑘 (6)
vector 𝐹 𝑉 (𝑘), 𝑘 = 1, 2, … , 64 is obtained by applying the perceptual
where 𝑣 is an additional growth parameter and | ⋅ | is an absolute value hashing algorithm.
operation. Fig. 7 displays the multiple period bifurcation plots and
∑
512
Lyapunov exponent for the improved logistic mapping. The Lyapunov 𝐹 𝐺(𝑝, 𝑞) = 𝐹 𝐴(𝑝, 𝑞, 𝑙) (8)
exponent is always positive when 𝑣 = 0.2, yielding better results for 𝑙=1
{
chaotic systems and significantly strengthening the keys’ security. 1, if 𝐹 𝐺 ≥ mean(𝐹 𝐺)
The improved logistic chaotic system is nonperiodic, nonconverg- 𝐹𝑉 = (9)
0, others
ing, and sensitive to initial conditions, while the relationship between
image blocks is controlled with a key, so that the resulting sequence Step 4: Generation of a zero-watermarking
is without duplicate elements. The improved logistic chaotic system The encrypted watermarking image 𝑊1 is XORed with the feature
is highly stealthy, which results in a remarkable enhancement in the vector 𝐹 𝑉 to construct a zero-watermarking 𝑍.
scheme’s security.
𝑍(𝑖, 𝑗) = 𝐹 𝑉 (𝑘) ⊕ 𝑊1 (𝑖, 𝑗) (10)

3. Proposed zero-watermarking scheme where 1 ≤ 𝑖, 𝑗 ≤ 64. For safety, we keep the zero-watermarking 𝑍 and
the key 𝐾1 in a third-party protection center.
3.1. Watermarking embedding scheme
3.2. Watermarking extraction scheme
The scheme assumes that 𝐹 = {𝑓 (𝑖, 𝑗) ∣ 1 ≤ 𝑖 ≤ 𝑀, 1 ≤ 𝑗 ≤ 𝑀} is
the original medical image and 𝑊 = {𝑤(𝑖, 𝑗) ∣ 1 ≤ 𝑖 ≤ 𝑁, 1 ≤ 𝑗 ≤ 𝑁} The tested medical image is expressed as 𝐹 ′ = {𝑓 ′ (𝑖, 𝑗) ∣ 1 ≤ 𝑖 ≤
is the binary watermarking image. The process of generating a zero- 𝑀, 1 ≤ 𝑗 ≤ 𝑀}. The process of extracting the watermarking image is
watermarking is described in Fig. 8, and the main steps are given described in Fig. 8, and the main steps are given below:
below: Step 1: Constructing feature vectors
Step 1: Encryption of the watermarking image For the tested medical image 𝐹 ′ , steps 2 and 3 in Section 3.1 are
The watermarking image is encrypted using improved logical repeated to obtain the feature sequence 𝐹 𝑉 ′ (𝑘), 𝑘 = 1, 2, … , 64.
chaotic scrambling to obtain a scrambled watermarking image 𝑊1 with Step 2: Extracting the watermarking image

5
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 7. (a) Logistic mapping multiple period bifurcation diagram and (b) Lyapunov exponent diagram for growth parameter 𝑣 = 0.2.

Algorithm 1 Watermarking Embedding Scheme Algorithm 2 Watermarking Extraction Scheme

Input: Original medical image 𝐹 (size is 𝑀 × 𝑀), original binary Input: Attacked medical image 𝐹 ′ (size is 𝑀 × 𝑀), Zero-watermarking
watermarking image 𝑊 (size is 𝑁 × 𝑁) key 𝑍 (size is 𝑁 × 𝑁)
Output: Zero-watermarking extraction key 𝑍 (size is 𝑁 × 𝑁) Output: The decrypted watermarking information 𝑊 ′ (size is 𝑁 × 𝑁)
∙ Encrypting watermarking ∙ Extracting deep features
1: Initialize the parameters 𝜇0 and 𝑥 of the improved Logistic chaotic 1: Sending 𝐹 ′ (𝑖, 𝑗) into the pretrained DO-VGG network to extract
map feature images 𝐹𝐴′ (𝑝, 𝑞, 𝑙)
2: for 𝑖 = 1, 2, … , 𝑁 × 𝑁 − 1 do 2: 𝐹𝐴′ (𝑝, 𝑞, 𝑙) ← 𝐷𝑂 − 𝑉 𝐺𝐺 ← 𝐹 ′ (𝑖, 𝑗)
∑512
3: 𝑊1 ← the improved Logistic chaotic Map (𝑊 , 𝜇0 , 𝑥) 3: 𝐹𝐺′ (𝑝, 𝑞) ← 𝑙=1 𝐹𝐴′ (𝑝, 𝑞, 𝑙)
4: end for ∙ Constructing feature vector
∙ Extracting deep features 4: 𝐹𝐺′ _𝑚𝑒𝑎𝑛 ← 𝑚𝑒𝑎𝑛(𝐹 𝐺′ (𝑝, 𝑞))
5: Sending 𝐹 (𝑖, 𝑗) into the pretrained DO-VGG network to extract 5: Compare feature value
feature images 𝐹𝐴(𝑝, 𝑞, 𝑙) 6: if 𝐹𝐺′ ≥ 𝐹 𝐺′ _𝑚𝑒𝑎𝑛 then
6: 𝐹𝐴(𝑝, 𝑞, 𝑙) ← 𝐷𝑂 − 𝑉 𝐺𝐺 ← 𝐹 (𝑖, 𝑗) 7: 𝐹𝑉 ′ ← 1
∑512
7: 𝐹𝐺(𝑝, 𝑞) ← 𝑙=1 𝐹𝐴(𝑝, 𝑞, 𝑙) 8: else
∙ Constructing feature vector 9: 𝐹𝑉 ′ ← 0
8: 𝐹 𝐺_𝑚𝑒𝑎𝑛 ← 𝑚𝑒𝑎𝑛(𝐹𝐺(𝑝, 𝑞)) 10: end if
9: Compare feature value ∙ Extract the watermarking image
10: if 𝐹𝐺 ≥ 𝐹 𝐺_𝑚𝑒𝑎𝑛 then 11: 𝑊1′ ← 𝑍 ⊕ 𝐹 𝑉 ′
11: 𝐹𝑉 ← 1 ∙ Decrypting the watermarking image
12: else 12: Applying initial parameters 𝜇0 and 𝑥 of the improved Logistic
13: 𝐹𝑉 ← 0 chaotic map
14: end if 13: for 𝑖 = 1, 2, … , 𝑁 × 𝑁 − 1 do
∙ Generated the zero-watermarking key 14: 𝑊 ′ ← the improved Logistic chaotic restoration (𝑊1′ , 𝜇0 , 𝑥)
15: 𝑍 ← 𝑊1 ⊕ 𝐹𝑉 15: end for
16: Calculate the NC values between 𝑊 ′ and 𝑊

The watermarking image 𝑊1′ is obtained by XORing the feature

vector 𝐹 𝑉 ′ with the extraction key 𝑍. The formula is shown below: to data enhancement operations such as compression, filtering, and
geometric attacks, and the total size of the extended dataset was 62,000
sheets. The model was trained and fine-tuned several times to select
𝑊1′ (𝑖, 𝑗) = 𝐹 𝑉 ′ (𝑘) ⊕ 𝑍(𝑖, 𝑗) (11) the best hyperparameters for the proposed DO-VGG network with a
Step 3: Decrypting the watermarking image learning rate of 0.0001, a batch size of 64 and an epoch of 100.
The decrypted watermarking image 𝑊 ′ is generated by logistic We conducted experiments using a large number of medical images
chaotic recovery of the scrambled watermarking image 𝑊1′ . Comparing to prove the effectiveness of the schemes in this paper. In this paper,
𝑊 with 𝑊 ′ , the more similar they are, the more robust the scheme. medical images of different body parts and organs, such as the brain,
lungs, and eye, of size 128 × 128 are selected as the original medical
images displayed in Fig. 9. Both the watermarking image and the
4. Experimental analysis
scrambled watermarking image are resampled at a size of 64 × 64 in
Fig. 10.
4.1. Datasets

4.2. Evaluation indicators

All the experimental data in this paper were acquired from the
public medical image database provided by Kaggle, a data resource
This paper evaluates the quality of attacked medical images by the
containing different parts and different types of medical images. In
peak signal-to-noise ratio (PSNR) [35]. The PSNR is defined as follows:
this experiment, 100 categories of medical images were selected as the
dataset of the model, and the dataset was divided into a training set ( )
and a test set at a ratio of 7:3. Furthermore, to reduce the impact of 𝑀𝐴𝑋
𝑃 𝑆𝑁𝑅 = 20 × log10 √ (12)
additional factors on recognition, the original dataset was subjected 𝑀𝑆𝐸

6
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 8. Embedding and extraction of zero-watermarking.

Fig. 9. Original medical images: (a) brain, (b) foot, (c) kidney, (d) lung, (e) hand, (f) breast, (g) fundus vessels, and (h) chest X-ray.

where 𝑊 (𝑖, 𝑗) and 𝑊 ′ (𝑖, 𝑗) are the original watermarking image and the
restored watermarking image of size 𝑁 × 𝑁, respectively. The higher
the NC value is, the higher the correctness and robustness of the
extracted watermarking image.

4.3. Robustness experiment

Medical images face a variety of malicious and nonmalicious attacks

during imaging and transmission, such as Gaussian noise, compression
and rotation. To provide the proposed scheme with stronger robust-
Fig. 10. Watermarking images: (a) original watermarking image, and (b) scrambled
watermarking image. ness, malicious and nonmalicious attacks on the medical image are
deliberately performed in the attack simulation, which consists of three
common attacks and four geometric attacks. Common attacks reduce
the quality of the image by employing common image processing
∑ 𝑀−1
𝑀−1 ∑ attacks, causing interference with feature extraction. Geometric attacks
1 ‖𝐼(𝑖, 𝑗) − 𝐼 ′ (𝑖, 𝑗)‖2
𝑀𝑆𝐸 = (13) disrupt the synchronization between the watermarking image and the
𝑀 × 𝑀 𝑖=0 𝑗=0 ‖ ‖
medical image by changing the spatial position of the image pixels,
where 𝑀𝐴𝑋 is the maximum value of the pixel in the image, 𝐼(𝑖, 𝑗) causing the watermarking image extraction to be faulty.
and 𝐼 ′ (𝑖, 𝑗) denote the original medical image and the attacked medical (1) Noise Attacks
image with the size of 𝑀 × 𝑀, respectively. The higher the PSNR value Gaussian noise attacks obey a normal distribution, which directly
adds noise with random noise depth to each pixel point of the image.
is, the less distorted the image.
We performed Gaussian noise attacks on various medical images and
Robustness means that the medical image can still extract the wa- the findings are displayed in Fig. 11 and Table 1. The data show
termarking image with integrity after the attack. Robustness is judged that the medical images are visually blurred when the Gaussian noise
by the normalized correlation coefficient (NC) [36], which is defined intensity is 35%, but the extracted watermarking images are still highly
as follows: recognizable. Under 50% noise attack, the mean PSNR drops to 6.7 dB,
∑𝑁 ∑𝑁 ′ while the mean NC value remains at 0.9687, and the watermarking
𝑖=1 𝑗=1 𝑊 (𝑖, 𝑗) × 𝑊 (𝑖, 𝑗)
𝑁𝐶 = √ (14) image can still be identified. This indicates that the scheme in this paper
∑𝑁 ∑𝑁 2
∑𝑁 ∑𝑁 ′2
𝑖=1 𝑗=1 𝑊 (𝑖, 𝑗) × 𝑖=1 𝑗=1 𝑊 (𝑖, 𝑗) remains strongly robust against the interference of Gaussian noise.

7
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Table 1
The experimental results with noise attacks.
Attack intensity 5% 15% 25% 35% 50%
PSNR/dB 14.9211 10.8216 9.2186 8.3215 7.4323
Brain
NC 0.9875 0.9625 0.9751 0.9500 0.9501
PSNR/dB 15.4594 11.1236 9.3926 8.4331 7.5611
Foot
NC 0.9626 0.9627 0.9629 0.9626 0.9875
PSNR/dB 15.3659 11.0452 9.3504 8.4228 7.5058
Kidney
NC 0.9998 0.9625 0.9625 0.9625 0.9625
PSNR/dB 15.0648 11.0072 9.343 8.4511 7.5573
Lung
NC 0.9753 0.9502 0.9375 0.9627 0.9628
PSNR/dB 12.8336 8.6449 6.947 6.0296 5.1598
Hand
NC 0.9998 0.9626 0.9626 0.9626 0.9751
PSNR/dB 11.5625 7.5613 6.0113 5.1249 4.3428
Breast
NC 0.9751 0.9751 0.9875 0.9875 0.9998
PSNR/dB 12.7909 9.1113 7.74 6.9858 6.3347
Fundus vessels
NC 0.9751 0.9500 0.9750 0.9875 0.9750
PSNR/dB 14.2699 10.5403 9.1853 8.4048 7.7171
Chest X-ray
NC 0.9875 0.9374 0.9626 0.9626 0.9374

Fig. 11. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to 35% Gaussian noise attack: (a)–(a1) brain, (b)–(b1) foot,
(c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

Fig. 12. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to 2% JPEG compression attack: (a)–(a1) brain, (b)–(b1) foot,
(c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

(2) Compression Attacks of the extracted watermarking image is excellent and does not affect
JPEG compression is an important measure of the watermarking the reading of the information at 2% compression, indicating that the
system’s robustness. JPEG compression is lossy compression, which proposed scheme has excellent resistance to JPEG compression attacks.
mainly destroys the high-frequency parts of the quantization process. (3) Filtering Attacks
Table 2 displays the experimental results under the JPEG compression Median filtering replaces the pixel value with the median value in
attack when the compression factor is raised from 2% to 30%. The the neighbor of that point, allowing the surrounding pixel values to
table reflects that as the compression attack parameters rise, the NC approach the true value, thus eliminating isolated noise points. Median
values also rise, and after 15% compression the NC values are all filtering attacks generally blur the image and result in lost image
approximately equal to 1.00. Fig. 12 shows that the visual quality details. We applied median filtering attacks with different filtering

8
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Table 2
The experimental results with compression attacks.
Attack intensity 2% 5% 10% 15% 30%
PSNR/dB 20.707 22.0045 23.8912 24.9075 27.439
Brain
NC 0.9998 0.9998 0.9998 0.9998 0.9998
PSNR/dB 22.8844 24.6257 27.7277 29.1263 32.1493
Foot
NC 0.9998 0.9998 0.9998 0.9998 0.9998
PSNR/dB 22.3601 24.6339 27.9801 29.1991 31.7382
Kidney
NC 0.9875 0.9875 0.9998 0.9998 0.9998
PSNR/dB 22.6421 24.8765 28.2337 29.6194 32.2377
Lung
NC 0.9628 0.9753 0.9998 0.9998 0.9998
PSNR/dB 23.5478 25.4443 30.5291 31.9795 35.2794
Hand
NC 0.9998 0.9998 0.9998 0.9998 0.9998
PSNR/dB 24.0996 25.4521 30.7328 32.1558 35.7171
Breast
NC 0.9875 0.9753 0.9875 0.9998 0.9998
PSNR/dB 24.8238 26.8068 30.6778 32.882 35.5753
Fundus vessels
NC 0.9751 0.9875 0.9875 0.9875 0.9998
PSNR/dB 23.1791 26.2216 29.2714 31.1135 33.9486
Chest X-ray
NC 0.9374 0.9500 0.9875 0.9998 0.9998

Table 3
The experimental results with filtering attacks.
Attack intensity [3 × 3], 10times [3 × 3], 20times [5 × 5], 10times [5 × 5], 20times [7 × 7], 20times
PSNR/dB 20.91 20.3341 17.2479 16.6834 15.8398
Brain
NC 0.9500 0.9626 0.9875 0.9626 0.9875
PSNR/dB 24.4566 23.8304 20.9525 20.756 19.2607
Foot
NC 0.9998 0.9998 0.9627 0.9627 0.9502
PSNR/dB 25.8374 25.3201 20.3492 19.488 16.3098
Kidney
NC 0.9875 0.9875 0.9502 0.9502 0.9502
PSNR/dB 27.1206 26.0595 21.4811 20.1211 16.7191
Lung
NC 0.9998 0.9998 0.9875 0.9875 0.9627
PSNR/dB 34.4905 33.7313 24.073 21.0509 17.7943
Hand
NC 0.9998 0.9998 0.9875 0.9998 0.9875
PSNR/dB 35.173 34.9371 29.2758 28.4422 24.187
Breast
NC 0.9998 0.9998 0.9998 0.9998 0.9751
PSNR/dB 38.0983 37.8992 34.0887 33.6041 31.3894
Fundus vessels
NC 0.9998 0.9998 0.9750 0.9750 0.9499
PSNR/dB 33.3957 32.6356 25.4186 24.5428 18.4929
Chest X-ray
NC 0.9998 0.9998 0.9875 0.9875 0.9751

Fig. 13. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to [7 × 7, 20 times] median filtering attack: (a)–(a1) brain,
(b)–(b1) foot, (c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

multiples to different medical images. Fig. 13 and Table 3 show that effect of the medical image after geometric distortion is applied to
the medical image after the median filtering process differs greatly from the watermarking image. The experimental data under the clockwise
the original medical image and can only reflect the edge contours of the rotation attack in Fig. 14 and Table 4 show that the large angle of
image. However, all NC values remain above 0.94, and the information rotation causes a situation where features are missing and the extracted
in the extracted watermarking image can still be read. In summary, the watermarking image has some scattered distorted pixels. Despite this,
proposed scheme has some resistance to filtering attacks. the visual recognition of the extracted watermarking image is complete,
(4) Rotation Attacks with all NC values remaining above 0.9. It is demonstrated that the
Rotation attacks are the turning of an image around a point at proposed scheme can have better resistance to rotation attacks.
specified angles. The image does not change in width and height after (5) Scaling Attacks
rotation, but its origin and axis of symmetry change. This experi- Scaling attacks are used to modify the image size by adding or
ment uses the center rotation angle as a parameter to examine the removing pixel points. The medical images are scaled to change the

9
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 14. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to 27% rotation attack: (a)–(a1) brain, (b)–(b1) foot, (c)–(c1)
kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

Table 4
The experimental results with rotation attacks.
Attack intensity 5% 15% 20% 27% 35%
PSNR/dB 15.5831 12.2922 12.068 11.892 11.5145
Brain
NC 0.9875 0.9875 0.9875 0.9875 0.9875
PSNR/dB 19.2542 16.7201 15.8593 14.9035 14.2166
Foot
NC 0.9998 0.9875 0.9875 0.9751 0.9627
PSNR/dB 18.4628 13.274 12.2198 11.1448 10.2985
Kidney
NC 0.9753 0.9753 0.9628 0.9998 0.9873
PSNR/dB 18.2776 12.7127 11.4527 10.4822 10.1553
Lung
NC 0.9998 0.9251 0.9252 0.9122 0.9121
PSNR/dB 17.307 12.9733 12.5399 11.5883 10.9999
Hand
NC 0.9998 0.9875 0.9875 0.9753 0.9875
PSNR/dB 20.5585 14.6902 13.4887 12.4875 11.7728
Breast
NC 0.9877 0.9751 0.9751 0.9751 0.9751
PSNR/dB 32.0564 28.5347 27.4325 26.3445 25.588
Fundus vessels
NC 0.9998 0.9875 0.9875 0.9875 0.9998
PSNR/dB 16.1302 10.8537 9.7324 8.7843 8.3337
Chest X-ray
NC 0.9626 0.9500 0.9500 0.9626 0.9751

Fig. 15. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to zoom in 0.125 times and then zoom in 8 times attack:
(a)–(a1) brain, (b)–(b1) foot, (c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

overall image pixel values. In this paper, the different coefficients of 0.95. Consequently, the proposed scheme has excellent resistance to
scaling attacks are chosen to be implemented on medical images and scaling attacks.
the results are displayed in Fig. 15 and Table 5. The visual observation (6) Cropping Attacks
shows that under the attack of a reduction of 0.125 times followed Cropping attacks are the direct interception of a portion of the
original image, resulting in the loss of image information. Varying
by a magnification of 8 times, there is a greater visual impact on the
degrees of 𝑌 -axis cropping attacks were performed on medical images,
medical image, and the image details appear blurred. However, the with the cropped parts replaced by pixel values of one. From the data in
watermarking image can still be extracted relatively clearly, without Fig. 16 and Table 6, when cropped by 5%, the extracted watermarking
affecting the actual interpretation, and the NC values remain above image is very complete because there is no impact on the area where

10
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Table 5
The experimental results with scaling attacks.
Attack intensity Zoom 0.125 Zoom 0.25 Zoom 0.5 Zoom 2 then Zoom 4 then
then zoom 8 then zoom 4 then zoom 2 zoom 0.5 zoom 0.25
PSNR/dB 15.6234 17.8888 21.5809 30.2404 30.5191
Brain
NC 0.9875 0.9751 0.9875 0.9998 0.9998
PSNR/dB 21.2864 23.4321 27.4958 39.1937 39.4755
Foot
NC 0.9875 0.9875 0.9998 0.9998 0.9998
PSNR/dB 17.7394 21.6781 27.9378 39.3732 39.6573
Kidney
NC 0.9500 0.9499 0.9751 0.9998 0.9998
PSNR/dB 17.5737 21.7354 28.2851 39.7027 39.9814
Lung
NC 0.9251 0.9375 0.9875 0.9998 0.9998
PSNR/dB 21.5238 28.3163 34.9929 47.5906 47.965
Hand
NC 0.9502 0.9998 0.9998 0.9998 0.9998
PSNR/dB 27.2548 31.7092 37.6185 48.3699 49.124
Breast
NC 0.9998 0.9998 0.9998 0.9998 0.9998
PSNR/dB 27.2848 31.7462 36.956 47.6338 48.3675
Fundus vessels
NC 0.9751 0.9875 0.9875 0.9998 0.9998
PSNR/dB 22.4274 26.9058 32.8383 43.4542 43.846
Chest X-ray
NC 0.9626 0.9875 0.9998 0.9998 0.9998

Table 6
The experimental results with cropping attacks.
Attack intensity 5% 10% 25% 35% 40%
PSNR/dB 22.6105 18.7664 13.59 11.7049 11.006
Brain
NC 0.9998 0.9875 0.9753 0.9753 0.9627
PSNR/dB 33.135 29.608 23.5875 20.3542 19.1855
Foot
NC 0.9998 0.9998 0.9626 0.9627 0.9627
PSNR/dB 90.275 45.8285 20.3558 14.5873 13.5934
Kidney
NC 0.9998 0.9998 0.9875 0.9373 0.9373
PSNR/dB 49.1447 24.9866 14.8648 12.4851 11.5428
Lung
NC 0.9998 0.9998 0.9502 0.9500 0.9500
PSNR/dB 22.4116 19.4612 15.7536 14.075 13.3985
Hand
NC 0.9998 0.9875 0.9875 0.9751 0.9501
PSNR/dB 70.284 32.9291 16.7177 13.1849 11.9204
Breast
NC 0.9998 0.9998 0.9753 0.9626 0.9751
PSNR/dB 34.6909 26.0862 18.0225 14.7462 13.5214
Fundus vessels
NC 0.9875 0.9875 0.9875 0.9875 0.9501
PSNR/dB 15.0472 11.9284 8.7809 7.6988 7.2433
Chest X-ray
NC 0.9751 0.9501 0.9626 0.9626 0.9751

Table 7
The experimental results with translation attacks.
Attack intensity 5% 10% 16% 28% 50%
PSNR/dB 11.1507 10.4055 8.8457 7.2753 6.475
Brain
NC 0.9751 0.9751 0.9751 0.9374 0.9119
PSNR/dB 14.9462 13.4479 12.4753 12.4277 14.1489
Foot
NC 0.9751 0.9626 0.9501 0.9375 0.9252
PSNR/dB 11.7941 9.895 8.7146 9.8711 9.0871
Kidney
NC 0.9998 0.9877 0.9753 0.9375 0.9376
PSNR/dB 12.1661 10.6195 9.3024 7.868 6.4063
Lung
NC 0.9875 0.9750 0.9625 0.9373 0.9244
PSNR/dB 12.466 11.7 9.6837 8.1182 8.6091
Hand
NC 0.9998 0.9998 0.9877 0.9628 0.9374
PSNR/dB 16.7173 13.1721 10.5958 7.8511 5.9921
Breast
NC 0.9877 0.9877 0.9628 0.9502 0.9122
PSNR/dB 19.6375 16.6564 14.2228 11.375 9.0046
Fundus vessels
NC 0.9751 0.9500 0.9628 0.9501 0.9627
PSNR/dB 12.639 9.5097 7.5031 6.262 4.6579
Chest X-ray
NC 0.9751 0.9501 0.9119 0.8470 0.8473

the extracted image feature points are located. When the cropping area be read well and does not influence practical application. Even with the
is extended, more information is lost in the image. However, the visual 50% left translation, all NC values are over 0.9, except for those of the
identification of the extracted watermarking image is complete, and chest X-ray with the NC value staying at 0.84. Therefore, the scheme
the NC values are all greater than 0.93. Overall, the proposed scheme has strong resistance to translation attacks.
maintains strong robustness under cropping attacks. The experimental results show that the proposed scheme has ex-
(7) Translation Attacks cellent robustness in resisting geometric and common attacks. Since
Translation attacks add a specified horizontal offset and vertical the scheme in this paper uses deep neural networks combined with
offset to all pixel coordinates of an image. Translation attacks discard attention mechanisms to extract feature vectors, the proposed scheme
image information directly. Fig. 17 and Table 7 reveal that when the has a high degree of translation, scaling, rotation, and other geometric
translation distance is increased, some of the areas for extracting fea- invariances. Moreover, using the attention mechanisms to enhance
ture points are subtracted, directly affecting the quality of the extracted channel and spatial features, effectively strengthens the scheme’s abil-
watermarking images. However, the restored watermarking image can ity to resist both common and geometric attacks. To summarize, the

11
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 16. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to 35% 𝑌 -axis cropping attack: (a)–(a1) brain, (b)–(b1) foot,
(c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

Fig. 17. Eight kinds of tested medical images and the corresponding reconstructed watermarking images subjected to 30% left translation attack: (a)–(a1) brain, (b)–(b1) foot,
(c)–(c1) kidney, (d)–(d1) lung, (e)–(e1) hand, (f)–(f1) breast, (g)–(g1) fundus vessels, and (h)–(h1) chest X-ray.

scheme in this paper exhibits strong robustness under different kinds

of attacks.

5. Experimental comparison

5.1. Classification experiments

To better evaluate the performance of the proposed network, this

paper conducts image classification experiments with the same experi-
mental dataset and parameters described in Section 4.1. The proposed
network is compared with some classical networks, including AlexNet,
VGG19, ResNet18, ResNet50, and MobileNet-V2. Fig. 18 shows the
accuracy comparison histogram for each network. The classification
accuracy of the proposed network improves by approximately 4% over
that of MobileNet-V2 and by approximately 1% over the classification
accuracies of the other four classical networks. The proposed network
is trained with more parameters configured by the DO-Conv, which
makes the network have better expressiveness. The channel attention Fig. 18. Classification accuracy comparison results of six schemes.
mechanism and the spatial attention mechanism are also introduced to
enhance the ability of the proposed network to extract global features.
Overall, the proposed network has a stronger generalization capability. and DO-Conv on feature extraction, four experimental groups were
set up in this experiment: VGG16, VGG16+DO-Conv, VGG16+CBAM,
5.2. Ablation experiments and VGG16+DO-Conv+CBAM network models. We demonstrated the
validity of the proposed model through a series of ablation experiments
The scheme in this paper combines the DO-Conv module and CBAM using different medical images. The results are given in Fig. 19.
to design a new neural network model to extract high-dimensional As shown in Fig. 19, the robustness of the proposed scheme is ef-
robust features from medical images. To validate the effect of the CBAM fectively improved by adding both the DO-Conv module and CBAM for

12
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 19. Experimental results of the ablation comparison: (a) Gaussian noise, JPEG compression, and median filtering; (b) rotation, scaling, and left translation; (c) down translation,
𝑋-axis cropping, and 𝑌 -axis cropping.

common attacks. Although the NC value of VGG+DO-Conv is slightly medical image of the brain of size 128 × 128 is used as the original
lower than that of VGG16 for the 8% JPEG compression attack, it has medical image and the binary watermarking image of size 64 × 64 is
a significant advantage over other attacks with different parameters. used with the letters ‘‘CQWU’’ as the original watermarking image. The
Among the four groups of models, the VGG16+DO-Conv+CBAM model comparison results of the six schemes subjected to different kinds of
had the highest NC values under different degrees of common attacks. attacks are displayed in Figs. 20 and 21.
For geometric attacks, the NC values increase slightly with the As shown in Fig. 20, the proposed scheme is improved by approx-
addition of the DO-Conv module in terms of rotation and translation imately 2%–15% over the existing schemes [11–14,16] in terms of
attacks. The scheme’s robustness is greatly strengthened by the addition Gaussian noise attacks. Even with the 50% noise attack, the NC value
of the CBAM, and the NC values are always above 0.8. For cropping and obtained by the scheme in this paper is greater than 0.95, while the
scaling attacks, the difference in the NC values between the four models NC values of the other five schemes are only approximately 0.8. In
is small, but there is some improvement in robustness with the addition terms of JPEG compression attacks, the proposed scheme obtains NC
of the DO-Conv module and CBAM. The VGG16+DO-Conv+CBAM values of 0.99 for attacks of different strengths, which is still a small
model has stronger robustness than the other three models under improvement in robustness compared to that of the remaining five
different levels of attack. schemes. With a 3 × 3 filtering template, the scheme in this paper is
The convolution kernels of VGG16 are incremented sequentially, almost identical to the other schemes [11,12,16] in terms of the NC
and the number of channels changes with the loss of significant value, slightly below that of the scheme [13] and an improvement
amounts of useful information. Most existing image recognition meth- of approximately 10% over that of the scheme [14]. However, when
ods perform feature extraction on the whole image and cannot identify the filter template is larger than, the NC values of the other two
salient parts of the image, resulting in the model having poor feature schemes [11,16] vary considerably, while the NC value of the scheme
extraction capabilities. Therefore, the scheme in this paper introduces in this paper is almost unchanged.
DO-Conv and the CBAM to make the network more information-rich Since scheme [13] constructs a zero-watermarking using spatial
in the process of aggregating information by convolution, to retain as relations of image subblocks, such relations are based on the spatial
much useful data as possible, and to speed up the network training. stability of the image and provide good resistance against nongeo-
This shows that the addition of the CBAM and DO-Conv modules metric attacks. The Zernike moments used by the scheme [16] can
makes the network model more robust and has better feature extraction optimize the extraction of edge features of the image, but much de-
capabilities. tailed information is lost. Schemes [11,12,14] utilize the DTCWT,
contourlet transform, and curvelet transform to extract directional and
5.3. Comparison with other schemes detailed features of images, so they show good performance in terms
of common attacks. However, the scheme [14] uses SVD to extract
To highlight the advantages of the scheme in this paper, a com- the low-frequency coefficients of the DWT, which cannot portray the
parison experiment was performed on the proposed scheme and the features of the original image well, so the robustness is slightly lower.
schemes developed by Liu et al. [11], Wu et al. [12], Li et al. [13], The scheme in this paper uses the DO-VGG model to better extract
Wu et al. [14], and Yang et al. [16]. To ensure a fair comparison, a complex features such as medical image scale, brightness, and texture

13
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Fig. 20. Comparison of experimental results of common attacks: (a) Gaussian noise, (b) JPEG compression, and (c) median filtering.

Fig. 21. Comparison of experimental results of geometric attacks: (a) rotation, (b) scaling, (c) 𝑋-axis cropping, (d) 𝑌 -axis cropping, (e) left translation, and (f) down translation.

sensitivity. The DO-Conv module and CBAM are introduced at the When the translation and cropping areas are too large, the scheme
same time, which extract richer high-level features by giving different [14] is unable to extract stable curvelet coefficients and block singular
weights of attention to different parts of the image, thus constructing a values, resulting in the feature matrix being poorly stable and unable to
zero-watermarking with stronger robustness. As a result, the proposed extract a clear watermarking image. Scheme [13] uses energy relations
scheme is more robust under common attacks. to construct a zero-watermarking, and the balance of energy relations
As seen from Fig. 21, compared to the existing schemes [11–14,16], is easily broken in geometric attacks, leading to changes in the spa-
the proposed scheme has a substantial improvement in performance tial relations of the image with poor robustness. Schemes [11,12,16]
against geometric attacks, with a maximum performance enhancement construct a zero-watermarking using DCT means, and when the image
of approximately 30%. For translational and rotational attacks, the is geometrically attacked, the relationship between the mean and the
proposed scheme maintains NC values above 0.9, and only for down-
whole is easily changed, and making the zero-watermarking unstable.
ward translations of 42% does the resistance to attack decrease, with
Scheme [12] utilizes a contourlet transform without translational in-
the NC value of 0.88. The NC values for the other five schemes are
variance and is poorly robust against geometric attacks. The network
all approximately 0.6 under high-intensity attacks, and scheme [12]
structure of DO-VGG is highly invariant to translations, rotations, and
has the NC value of only 0.4 at a left translation of 20%. For scaling
cropping. The DO-Conv module and CBAM not only save computa-
attacks, the proposed scheme is relatively less robust than the other
two schemes [11,12], with their NC values exhibiting a 1% difference, tional resources and training time but also enable the extraction of
and the average NC value of the scheme in this paper reaches 0.99, high-dimensional complex features of images, giving the model better
indicating that the proposed scheme has better robustness under scaling feature extraction capabilities and exhibiting stronger robustness under
attacks. For the cropping operations at different locations, the proposed geometric attacks.
scheme has a maximum NC value of 0.99 and a minimum NC value The above experimental analysis of different kinds of attacks shows
above 0.95, both of which are better than the other schemes [11– that the proposed scheme is significantly better than the other five
14,16] and have excellent stability. When cropping to approximately schemes in terms of resistance to common and geometric attacks.
40%, the NC values of the other three schemes [11,12,16] are only In summary, the proposed scheme has excellent robustness and can
approximately 0.7. effectively resist various attacks.

14
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

Table 8
The average computation time between the proposed scheme and the other schemes [11–14,16].
Liu et al. [11] Wu et al. [12] Li et al. [13] Wu et al. [14] Yang et al. [16] Proposed scheme
Zero-watermarking embedding time (s) 0.7261 0.6989 0.6423 0.7644 0.6653 1.3451
Zero-watermarking extraction time (s) 0.7493 0.7485 0.6695 0.8312 0.7204 1.3561

5.4. Computation time Data availability

For a more comprehensive evaluation of the scheme’s performance, Data will be made available on request.
the computation times of the proposed zero-watermarking scheme
and existing schemes [11–14,16] were compared in the same exper- Acknowledgments
imental environment. Table 8 shows the average computation time
of the six schemes for zero-watermarking embedding and extraction This work was supported by the General Project of Chongqing Nat-
of brain images. Table 8 shows that for both main stages of zero-
ural Science Foundation of China (No. cstc2020jcyj-msxmX0422), the
watermarking, the average computation time of the proposed scheme is
Hainan Provincial Natural Science Foundation of China (No. 620MS067)
approximately 0.5 s longer than the computation times of schemes [11–
and the Postgraduate research innovation project of Chongqing (No.
14,16]. This is because the deep neural network has higher time
CYS22694).
complexity. This difference is negligible in practical applications, and
thus, the computation time of the proposed zero-watermarking scheme
is acceptable. References

6. Conclusion [1] K. Fares, A. Khaldi, K. Redouane, E. Salah, DCT & DWT based watermarking
scheme for medical information security, Biomed. Signal Process. Control 66
(2021) 102403.
Targeting the shortcomings of traditional medical image watermark- [2] K. Swaraja, K. Meenakshi, P. Kora, An optimized blind dual medical image
ing schemes under attack, in this paper, a lossless watermarking scheme watermarking framework for tamper localization and content authentication in
for medical images based on DO-VGG combined with an attention secured telemedicine, Biomed. Signal Process. Control 55 (2020) 101665.
mechanism is proposed. First, the deep high-dimensional features of [3] M. Elhoseny, G. Ramírez-González, O.M. Abu-Elnasr, S.A. Shawkat, N. Arunku-
mar, A. Farouk, Secure medical data transmission model for IoT-based healthcare
medical images are extracted with the pretrained DO-VGG model,
systems, IEEE Access 6 (2018) 20596–20608.
and then a binary sequence is generated using a perceptual hashing [4] Z. Xia, X. Wang, C. Wang, C. Wang, B. Ma, Q. Li, M. Wang, T. Zhao, A robust
scheme, which is calculated with the scrambled watermarking image zero-watermarking algorithm for lossless copyright protection of medical images,
to create a zero-watermarking. The proposed scheme extracts features Appl. Intell. 52 (2022) 607–621.
using deep neural networks, making the scheme highly invariant to [5] Z. Xia, X. Wang, C. Wang, B. Ma, M. Wang, Y.-Q. Shi, Local quaternion polar
translation, scaling, rotation, and other geometric attacks. The pro- harmonic Fourier moments-based multiple zero-watermarking scheme for color
medical images, Knowl.-Based Syst. 216 (2021) 106568.
posed scheme uses the DO-Conv to efficiently reduce the number of
[6] K. Fares, A. Khaldi, K. Redouane, E. Salah, A robust blind medical image
parameters and accelerate the convergence speed of the network. The watermarking approach for telemedicine applications, Cluster Comput. 24 (2021)
CBAM extracts deep-level features from the image in both channel and 2069–2082.
spatial dimensions, enhancing the scheme’s ability to resist common [7] X. yang Wang, S. yu Zhang, T. tao Wen, H. ying Yang, P. pan Niu, Coefficient
attacks and geometric attacks. In addition, the proposed scheme utilizes difference based watermark detector in nonsubsampled contourlet transform
an improved logistic chaotic mapping combined with an encryption domain, Inform. Sci. 503 (2019) 274–290.
[8] P. Khare, V.K. Srivastava, A secured and robust medical image watermarking
scheme to encrypt the watermarking image, using zero-watermarking
approach for protecting integrity of medical images, Trans. Emerg. Telecommun.
techniques to achieve embedding and extraction of the watermarking, Technol. 32 (2) (2020) e3918.
improving the scheme’s security while satisfying the special require- [9] Z. Xia, X. Wang, W. Zhou, R. Li, C. Wang, C. Zhang, Color medical image lossless
ments of medical images. Our results indicate that the proposed scheme watermarking using chaotic system and accurate quaternion polar harmonic
can successfully resist various attacks, and all NC values remain above transforms, Signal Process. 157 (2019) 108–118.
0.8, with better robustness and high security. The proposed scheme [10] T. Huang, J. Xu, Y. Yang, B. Han, Robust zero-watermarking algorithm for
medical images using double-tree complex wavelet transform and Hessenberg
provides effective protection for cloud storage and transmission of
decomposition, Mathematics 10 (7) (2022) 1–19.
medical images. [11] J. Liu, J. Li, K. Zhang, U.A. Bhatti, Y. Ai, Zero-watermarking algorithm for
Our future work will consider the application of deep learning to the medical images based on dual-tree complex wavelet transform and discrete cosine
entire medical image copyright protection scheme. The scheme will be transform, J. Med. Imag. Health Inform. 9 (1) (2019) 188–194.
designed to be more universal and robust for different kinds of medical [12] X. Wu, J. Li, R. Tu, J. Cheng, U.A. Bhatti, Contourlet-DCT based multiple
robust watermarkings for medical images, Multimedia Tools Appl. 78 (2019)
images and different attacks while ensuring no damage to the medical
8463–8480.
images. [13] W. Li, X. Xiong, X. Daoxun, Robust zero-watermarking algorithm based on
chaotic and block energy relationship, Microelectron. Comput. 36 (11) (2019)
CRediT authorship contribution statement 30–36.
[14] D. Wu, Y. Tang, W. Zhao, Y. Wan, C. Qu, Zero-watermarking algorithm based
Tongyuan Huang: Validation, Formal analysis, Resources, Writing on Curvelet-DWT-SVD, J. Yanshan Univ. 44 (1) (2020) 38–48.
– review & editing, Supervision, Funding acquisition. Jia Xu: Concep- [15] K.M. Hosny, M.M. Darwish, New geometrically invariant multiple zero-
watermarking algorithm for color medical images, Biomed. Signal Process.
tualization, Methodology, Software, Validation, Data curation, Writing
Control 70 (2021) 103007.
– original draft, Visualization. Shixin Tu: Validation, Investigation, [16] C. Yang, J. Li, U.A. Bhatti, J. Liu, J. Ma, M. Huang, Robust zero watermarking
Data curation, Writing – original draft, Visualization. Baoru Han: algorithm for medical images based on Zernike-DCT, Secur. Commun. Netw.
Conceptualization, Validation, Resources, Writing – review & editing, 2021 (4944797) (2021) 1–8.
Visualization, Supervision, Project administration, Funding acquisition. [17] U. Verma, N. Sharma, A ‘Divide and Embed’ approach in a robust crypto-
watermarking technique for enhancing the embedding capacity, Biomed. Signal
Declaration of competing interest Process. Control 76 (2022) 103694.
[18] M. Yamni, H. Karmouni, M. Sayyouri, H. Qjidaa, Robust zero-watermarking
scheme based on novel quaternion radial fractional Charlier moments,
The authors declare that they have no known competing finan- Multimedia Tools Appl. 80 (2021) 21679–21708.
cial interests or personal relationships that could have appeared to [19] J. Zhao, J. Yang, Y. Li, Zero image watermarking authentication algorithm based
influence the work reported in this paper. on K-nearest neighbor mean, Ship Electron. Eng. 38 (08) (2018) 107–108+115.

15
T. Huang et al. Biomedical Signal Processing and Control 81 (2023) 104478

[20] Z. Li, X. Zhou, X. Yin, L. Zhang, Robust reversible watermarking algorithm [29] J. Cao, Y. Li, M. Sun, Y. Chen, D. Lischinski, D. Cohen-Or, B. Chen, C. Tu,
for medical images based on deep residual network, J. Guizhou Univ. (Natural DO-Conv: Depthwise over-parameterized convolutional layer, IEEE Trans. Image
Sciences) 37 (3) (2020) 58–68. Process. 31 (2022) 3726–3736.
[21] B. Han, J. Du, Y. Jia, H. Zhu, Zero-watermarking algorithm for medical image [30] G. Fu, J. Huang, T. Yang, S. Zheng, Improved lightweight attention model based
based on VGG19 deep convolution neural network, J. Healthc. Eng. 2021 on CBAM, Biomed. Signal Process. Control 57 (20) (2021) 150–156.
(5551520) (2021) 1–12. [31] R. Niu, J. Yang, L. Xing, R. Wu, Micro-expression recognition algorithm based
[22] S. Aydın, Deep learning classification of neuro-emotional phase domain complex- on convolutional block attention module and dual path networks, J. Comput.
ity levels induced by affective video film clips, IEEE J. Biomed. Health Inf. 24 Appl. 41 (9) (2021) 2552–2559.
(6) (2020) 1695–1702. [32] S. Hao, X. Zhang, X. Ma, S. Sun, H. Wen, J. Wang, Q. Bai, Foreign object
[23] S. Aydın, B. Akın, Machine learning classification of maladaptive rumination and detection in coal mine conveyor belt based on CBAM-YOLOv5, J. China Coal
cognitive distraction in terms of frequency specific complexity, Biomed. Signal Soc. (2022).
Process. Control 77 (2022) 103740. [33] M. Kumar, P. Gupta, A new medical image encryption algorithm based on the 1D
[24] Y. Zhang, K. Chen, G. Zhou, L. Peizhuo, Y. Liu, L. Huang, Research progress of logistic map associated with pseudo-random numbers, Multimedia Tools Appl. 80
neural networks watermarking technology, J. Comput. Res. Dev. 58 (5) (2021) (2021) 18941–18967.
964. [34] A. Daoui, H. Karmouni, O. El ogri, M. Sayyouri, H. Qjidaa, Robust image
[25] Y. Adi, C. Baum, M. Cisse, B. Pinkas, J. Keshet, Turning your weakness into a encryption and zero-watermarking scheme using SCA and modified logistic map,
strength: Watermarking deep neural networks by backdooring, in: 27th USENIX Expert Syst. Appl. 190 (2022) 116193.
Security Symposium, 2018, pp. 1615–1631. [35] Y. Gao, X. Kang, Y. Chen, A robust video zero-watermarking based on deep con-
[26] Q. Chen, Z. Wang, Y. Chai, Multi-focus image fusion method based on improved volutional neural network and self-organizing map in polar complex exponential
VGG network, J. Appl. Opt. 41 (3) (2020) 500–507. transform domain, Multimedia Tools Appl. 80 (2021) 6019–6039.
[27] Y. Wei, Y. Zhengyi, Research on image retrieval technology combined with [36] T. Huang, J. Xu, Y. Yang, S. Tu, B. Han, Zero-watermarking algorithm for medical
attention and convolutional neural network, J. Chin. Comput. Syst. 42 (11) images based on nonsubsampled contourlet transform and double singular
(2021) 2368–2374. value decomposition, in: 2021 5th Asian Conference on Artificial Intelligence
[28] S. Woo, J. Park, J.-Y. Lee, I.S. Kweon, CBAM: Convolutional Block Attention Technology, ACAIT, Haikou, 2021, pp. 65–76.
module, in: Computer Vision, ECCV 2018, 2018, pp. 3–19.

16